Making HTTPS the Default in the World's Largest Bureaucracy
summary
Describes the US government’s effort to require HTTPS and HSTS for public web services across federal agencies, detailing technical and political challenges encountered during rollout. Covers coordination issues within a large, decentralized bureaucracy and shares practical lessons from 18F’s engineering work on privacy and security.
AI-written summary · about
chapters (15)
- 0:00Start
- 0:06Making HTTPS the Default in the World's Largest Bureaucracy Eric Mill, 18F, U.S. General Services Administration
- 5:28I work for the most exciting agency in the federal government
- 10:22Security and Privacy Controls for Federal Information Systems and Organizations
- 15:41federal agencies • Reports to the agency head and to Congress
- 19:16it's not enough just to make a new policy
- 39:51No one has a complete list of .gov web services
- 42:07HSTS is brand new to the federal space
- 43:25lots of malformed HSTS headers
- 46:06people are weird about certificates
- 46:45free or inexpensive DV certificates are completely acceptable for government use
- 48:53Enterprise inspection: still a thing
- 54:45we need to make it a plain HTTP preload list
- 55:03preloading.gov (requires state, local, tribal)
- 55:26we should push TLDs to require HTTPS going forward (enforced by preloading)
related talks
35mSetting the standard: Website security for the Norwegian government
37mHTTPS Is Better than Ever Before. Now Its Your Turn.
43mEmerging Web Security Standards
31m"I Have No Idea What I'm Doing" - On the Usability of Deploying HTTPS
42mLet's go HTTPS
48mOvercoming a million reasons not to be HTTPS only
59mProactively defending your business
46m2014.10.29 - Security@Scale - Jim O'Leary, Twitter